The dead can't speak for themselves. But they can apparently file U.S. tax returns.

A new audit of the Internal Revenue Service (IRS) has found the agency paid refunds to criminals who filed false tax returns, in some cases on behalf of people who had died, according to the Treasury Inspector General for Tax Administration (TIGTA), which is part of the U.S. Treasury.

The IRS stands to lose as much as US$21 billion in revenue over the next five years due to identity theft, according to TIGTA's audit, dated July 19 but publicized on Thursday.

TIGTA noted that the IRS did not agree with the $21 billion figure, but wrote that the figure does include estimated savings from new fraud control filters. Without new controls, TIGTA estimated losses of $26 billion.

Part of problem is that the IRS is not gathering enough data about fraud trends, such as how a return was filed, income information from W-2 forms, the amount of refunds and where those refunds were sent, TIGTA said.

"We found that $8.1 million in potentially fraudulent tax refunds involved tax returns filed from one of five addresses," the audit said.

In another example, a U.S. postal inspector based in Tampa, Florida, uncovered several tax refund schemes where funds were deposited into a debit-card account.

"According to the postal inspector, the successful schemes involved identity thieves using the SSNs (Social Security numbers) of deceased people and individuals who receive public assistance," the audit said.

The IRS said it detected 938,664 fake tax returns during the 2011 processing year, which would have cost $6.5 billion. While TIGTA said the figure was "substantial," it believes the IRS doesn't know how many identity thieves are filing bogus returns and how much money is lost.

TIGTA said it studied identity-theft characteristics and found 1.5 million fraudulent tax returns that were not detected by the IRS, which cost U.S. government coffers more than $5.2 billion.

The IRS has implemented new fraud detection measures, but TIGTA found that institutional procedures were undermining those efforts. For example, taxpayers can begin filing returns in mid-January, but third parties that have information linked to those tax returns do not have to file until March 31.

Although limited third-party information may be available, "the IRS has not developed processes to obtain and use this third-party information," TIGTA said.

The IRS is contacting some taxpayers to verify their identity. That simple measure stopped the issuance of $1.3 billion in potentially fraudulent tax returns as of April 19, TIGTA said.

The agency is also placing a "unique identity theft indicator" on the accounts of those who are deceased, TIGTA said. As of March, more than 164,000 tax accounts were locked, preventing $1.8 million in fraud, the audit said.

Send news tips and comments to jeremy_kirk@idg.com

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.